Executive brief
GoCD is a continuous delivery automation server that manages software build and deployment pipelines. The /jobStatus.json API in versions prior to 26.1.0 allows authenticated users to bypass access controls and retrieve sensitive job status information they should not have permission to view, including job identifiers, execution state, agent IP addresses and UUIDs, and associated pipeline and stage names. This enables attackers to discover and monitor jobs across pipelines outside their authorized scope, potentially revealing infrastructure details and pipeline structure.
Technical details
The /jobStatus.json API endpoint fails to validate that a requested server-assigned job ID belongs to the pipeline and stage specified in the API request. An authenticated attacker can enumerate job IDs and retrieve metadata for jobs in unauthorized pipelines through parameter tampering or ID guessing. The vulnerability requires authentication but does not require user interaction; console output, artifacts, commands, variables, and configuration details are not exposed. The issue is fixed in version 26.1.0 by improving validation logic during job status JSON retrieval.
Affected products
- ThoughtWorks GoCD prior to 26.1.0
Timeline
- 2026-09-21: disclosed
- 2026-07-06: patched: Fix released in version 26.1.0